{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/event-triggered-execution/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","wmi","event-triggered-execution","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers can abuse Windows Management Instrumentation (WMI), a powerful Windows management framework, to maintain persistent access to systems. This involves creating WMI event filters, providers, consumers, and bindings that execute code upon specific event triggers. This technique allows threat actors to subscribe to events and execute arbitrary code when those events transpire, ensuring a persistent foothold on the targeted system. The detection focuses on the use of \u003ccode\u003ewmic.exe\u003c/code\u003e with specific arguments used to set up malicious WMI event subscriptions, a common method for attackers seeking to establish persistence. This activity can be difficult to detect without specific monitoring rules, making it a valuable technique for attackers targeting a wide range of Windows environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: The attacker gains initial access to the system through various methods (not specified in source).\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation: The attacker may attempt to elevate privileges to perform WMI tasks.\u003c/li\u003e\n\u003cli\u003eDiscovery: The attacker uses reconnaissance commands to explore the WMI environment.\u003c/li\u003e\n\u003cli\u003eWMI Event Filter Creation: The attacker uses \u003ccode\u003ewmic.exe\u003c/code\u003e to create a WMI event filter that defines the event to monitor.\u003c/li\u003e\n\u003cli\u003eWMI Event Consumer Creation: The attacker uses \u003ccode\u003ewmic.exe\u003c/code\u003e to create an event consumer, such as \u003ccode\u003eActiveScriptEventConsumer\u003c/code\u003e or \u003ccode\u003eCommandLineEventConsumer\u003c/code\u003e, which specifies the action to take when the event occurs. This action is often malicious code execution.\u003c/li\u003e\n\u003cli\u003eWMI Binding Creation: The attacker creates a binding between the event filter and the event consumer, linking the trigger to the action.\u003c/li\u003e\n\u003cli\u003ePersistence: The WMI event subscription ensures that the malicious code is executed whenever the defined event occurs, providing persistence.\u003c/li\u003e\n\u003cli\u003eExecution: When the defined event occurs, the configured consumer executes the malicious payload.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to maintain persistent access to compromised systems. This can lead to data theft, system disruption, or further malicious activities within the network. Due to the nature of WMI, this persistence mechanism can be difficult to detect and remove, potentially granting long-term access to the attacker. This technique impacts all Windows systems where WMI is enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor process execution for \u003ccode\u003ewmic.exe\u003c/code\u003e with arguments \u0026quot;create\u0026quot;, \u0026quot;ActiveScriptEventConsumer\u0026quot;, or \u0026quot;CommandLineEventConsumer\u0026quot; to detect potential WMI event subscription abuse, as highlighted in the rule description.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule to detect suspicious usage of \u003ccode\u003ewmic.exe\u003c/code\u003e related to WMI event subscription for persistence.\u003c/li\u003e\n\u003cli\u003eInvestigate parent processes of \u003ccode\u003ewmic.exe\u003c/code\u003e for unexpected or unauthorized activity.\u003c/li\u003e\n\u003cli\u003eRegularly review WMI event filters, consumers, and bindings for any unauthorized or suspicious entries using tools like \u003ccode\u003ewevtutil\u003c/code\u003e or PowerShell.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T14:27:00Z","date_published":"2024-01-03T14:27:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-wmi-persistence/","summary":"Adversaries leverage Windows Management Instrumentation (WMI) to establish persistence by creating event subscriptions that trigger malicious code execution when specific events occur, often utilizing `wmic.exe` to create event consumers.","title":"Persistence via WMI Event Subscription","url":"https://feed.craftedsignal.io/briefs/2024-01-03-wmi-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Event-Triggered-Execution","version":"https://jsonfeed.org/version/1.1"}